83 matches found
CVE-2024-41597
Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. NOTE: this is disputed by the Supplier because the product intentionally accepts anonymous, unauthenticated comments and thus there are fewer situations in which CSRF would be a useful...
CVE-2024-41597
ProcessWire v3.0.229 is vulnerable to Cross-Site Request Forgery via its comments functionality, allowing a remote attacker to execute arbitrary code through a crafted HTML file. The connected PT-Security entry recommends updating to a newer version that includes a fix. No exploit details are pro...
Arbitrary Code Execution
Processwire is vulnerable to Arbitrary Code Execution. The vulnerability is due to the downloadzipurl parameter when installing new modules. which allows an attacker to execute arbitrary code and install a reverse shell...
Arbitrary Code Execution in Processwire
An issue found in Processwire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the downloadzipurl parameter when installing a new module...
GHSA-2CVG-W29M-J8XC Arbitrary Code Execution in Processwire
An issue found in Processwire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the downloadzipurl parameter when installing a new module...
CVE-2023-24676
An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the downloadzipurl parameter when installing a new module. NOTE: this is disputed because exploitation requires that the attacker is able to enter requests as an admin; however, a...
Code injection
An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the downloadzipurl parameter when installing a new module. NOTE: this is disputed because exploitation requires that the attacker is able to enter requests as an admin; however, a...
CVE-2023-24676
An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the downloadzipurl parameter when installing a new module. NOTE: this is disputed because exploitation requires that the attacker is able to enter requests as an admin; however, a...
PT-2024-12039 · Unknown · Processwire
Name of the Vulnerable Software and Affected Versions: ProcessWire version 3.0.210 Description: An issue in ProcessWire allows attackers to execute arbitrary code and install a reverse shell via the download zip url parameter when installing a new module. This issue is disputed as it requires the...
CVE-2023-24676
An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the downloadzipurl parameter when installing a new module. NOTE: this is disputed because exploitation requires that the attacker is able to enter requests as an admin; however, a...
ProcessWire security vulnerability
ProcessWire is a friendly and powerful open source CMS with a robust API. A security vulnerability exists in ProcessWire version 3.0.210, which originates from a vulnerability that allows an attacker to install a reverse shell via the downloadzipurl parameter when installing a new module and...
CVE-2023-24676
ProcessWire 3.0.210 is affected by a vulnerable download_zip_url parameter used when installing a new module, which can allow arbitrary code execution and a reverse shell. The Red Hat, Veracode, OSV, and related entries concur with the core issue; exploitation is described as requiring admin priv...
CVE-2023-24676
An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the downloadzipurl parameter when installing a new module. NOTE: this is disputed because exploitation requires that the attacker is able to enter requests as an admin; however, a...
Cross-Site Scripting (XSS)
processwire is vulnerable to cross-site scripting. The vulnerability exists due to lack of CSRF session validations in the executeEditBookmark function in rocessPageListerBookmarks.php which allows a remote attacker to inject and execute malicious JavaScript into the system...
Cross-Site Scripting (XSS)
processwire is vulnerable to cross-site scripting. The vulnerability is due to lack of sanitization in the search users and search pages functions which allows an attacker to inject and execute arbitrary JavaScript...
GHSA-8G35-PRRR-GXXF ProcessWire vulnerable to Cross-site Scripting
ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting XSS vulnerabilities via the Search Users and Search Pages function. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injection of a crafted payload...
GHSA-VPWH-QMWC-2PHG ProcessWire vulnerable to Cross-Site Request Forgery
ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery CSRF...
ProcessWire vulnerable to Cross-Site Request Forgery
ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery CSRF...
ProcessWire vulnerable to Cross-site Scripting
ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting XSS vulnerabilities via the Search Users and Search Pages function. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injection of a crafted payload...